ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

3356. [bug] Cap the TTL of signed RRsets when RRSIGs are

Browse Source 
approaching their expiry, so they don't remain
			in caches after expiry. [RT #26429]
This commit is contained in:
ckb
2012-07-25 17:06:34 -05:00
parent e13ffd32c2
commit e7857b5ee0
14 changed files with 366 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
bin/tests/system/dnssec/tests.sh
View File

@@ -1675,5 +1675,104 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:testing TTL is capped at RRSIG expiry time ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 freeze expiring.example 2>&1 | sed 's/^/I:ns3 /'
(
cd ns3
RANDFILE=../random.data
for file in K*.moved; do
mv $file `basename $file .moved`
done
$SIGNER -S -r $RANDFILE -N increment -e now+1mi -o expiring.example expiring.example.db > /dev/null 2>&1
) || ret=1
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reload expiring.example 2>&1 | sed 's/^/I:ns3 /'
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 flush
$DIG +noall +answer +dnssec +cd -p 5300 expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n
$DIG +noall +answer +dnssec -p 5300 expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n
ttls=`awk '{print $2}' dig.out.ns4.1.$n`
ttls2=`awk '{print $2}' dig.out.ns4.2.$n`
for ttl in $ttls; do
[ $ttl -eq 300 ] || ret=1
done
for ttl in $ttls2; do
[ $ttl -le 60 ] || ret=1
done
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:testing TTL is capped at RRSIG expiry time for records in the additional section ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 flush
$DIG +noall +additional +dnssec +cd -p 5300 expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
$DIG +noall +additional +dnssec -p 5300 expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
ttls=`awk '{print $2}' dig.out.ns4.1.$n`
ttls2=`awk '{print $2}' dig.out.ns4.2.$n`
for ttl in $ttls; do
[ $ttl -eq 300 ] || ret=1
done
for ttl in $ttls2; do
[ $ttl -le 60 ] || ret=1
done
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
cp ns4/named3.conf ns4/named.conf
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig 2>&1 | sed 's/^/I:ns4 /'
sleep 3
echo "I:testing TTL of about to expire RRsets with dnssec-accept-expired yes; ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 flush
$DIG +noall +answer +dnssec +cd -p 5300 expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n
$DIG +noall +answer +dnssec -p 5300 expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n
ttls=`awk '{print $2}' dig.out.ns4.1.$n`
ttls2=`awk '{print $2}' dig.out.ns4.2.$n`
for ttl in $ttls; do
[ $ttl -eq 300 ] || ret=1
done
for ttl in $ttls2; do
[ $ttl -le 120 -a $ttl -gt 60 ] || ret=1
done
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:testing TTL of expired RRsets with dnssec-accept-expired yes; ($n)"
ret=0
$DIG +noall +answer +dnssec +cd -p 5300 expired.example soa @10.53.0.4 > dig.out.ns4.1.$n
$DIG +noall +answer +dnssec -p 5300 expired.example soa @10.53.0.4 > dig.out.ns4.2.$n
ttls=`awk '{print $2}' dig.out.ns4.1.$n`
ttls2=`awk '{print $2}' dig.out.ns4.2.$n`
for ttl in $ttls; do
[ $ttl -eq 300 ] || ret=1
done
for ttl in $ttls2; do
[ $ttl -le 120 -a $ttl -gt 60 ] || ret=1
done
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:testing TTL is capped at RRSIG expiry time for records in the additional section with dnssec-accept-expired yes; ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 flush
$DIG +noall +additional +dnssec +cd -p 5300 expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
$DIG +noall +additional +dnssec -p 5300 expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
ttls=`awk '{print $2}' dig.out.ns4.1.$n`
ttls2=`awk '{print $2}' dig.out.ns4.2.$n`
for ttl in $ttls; do
[ $ttl -eq 300 ] || ret=1
done
for ttl in $ttls2; do
[ $ttl -le 120 -a $ttl -gt 60 ] || ret=1
done
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
exit $status